Leveraging attack graphs of agile security platform

ABSTRACT

Implementations of the present disclosure include receiving, from an agile security platform, attack graph (AG) data representative of one or more AGs, each AG representing one or more lateral paths within an enterprise network for reaching a target asset from one or more assets within the enterprise network, processing, by a security platform, data from one or more data sources to selectively generate at least one event, the at least one event representing a potential security risk within the enterprise network, and selectively generating, within the security platform, an alert representing the at least one event, the alert being associated with a priority within a set of alerts, the priority being is based on the AG data.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to U.S. Prov. App. No. 62/774,516 filedon Dec. 3, 2018, the disclosure of which is incorporated herein byreference in the entirety.

BACKGROUND

Computer networks are susceptible to attack by malicious users (e.g.,hackers). For example, hackers can infiltrate computer networks in aneffort to obtain sensitive information (e.g., user credentials, paymentinformation, address information, social security numbers) and/or totake over control of one or more systems. To defend against suchattacks, enterprises use security systems to monitor occurrences ofpotentially adverse events occurring within a network, and alertsecurity personnel to such occurrences. For example, one or moredashboards can be provided, which provide lists of alerts that are to beaddressed by the security personnel. In some instances, for relativelylarge networks, for example, a large number of alerts can be displayed.Alerts, however, are not all equal. For example, one alert can reflectan event that is less critical than an event reflected by another alert.Multiple alerts can result in dilution, and expending resources on lesscritical issues.

SUMMARY

Implementations of the present disclosure are directed to an agilesecurity platform for enterprise-wide cyber-security. More particularly,implementations of the present disclosure are directed to an agilesecurity platform that determines asset vulnerability of enterprise-wideassets including cyber-intelligence and discovery aspects of enterpriseinformation technology (IT) systems and operational technology (OT)systems, asset value, and potential for asset breach including hackinganalytics of enterprise IT/OT systems. The agile security platform ofthe present disclosure executes in a non-intrusive manner.

In some implementations, actions include receiving, from an agilesecurity platform, attack graph (AG) data representative of one or moreAGs, each AG representing one or more lateral paths within an enterprisenetwork for reaching a target asset from one or more assets within theenterprise network, processing, by a security platform, data from one ormore data sources to selectively generate at least one event, the atleast one event representing a potential security risk within theenterprise network, and selectively generating, within the securityplatform, an alert representing the at least one event, the alert beingassociated with a priority within a set of alerts, the priority being isbased on the AG data. Other implementations of this aspect includecorresponding systems, apparatus, and computer programs, configured toperform the actions of the methods, encoded on computer storage devices.

These and other implementations can each optionally include one or moreof the following features: the alert is associated with an asset and isassigned an initial priority, and the priority includes an elevatedpriority relative to the initial priority based on the AG data; theinitial priority is elevated to the priority in response to determiningthat the asset is included in a critical path represented within the AGdata; the event is selectively generated based on filtering a pluralityof potential events based on the AG data; each AG is generated by adiscovery service of the agile security platform, the discovery servicedetecting assets using one or more adaptors and respective assetdiscovery tools that generate an asset inventory and a network map ofthe enterprise network; each AG is associated with a target within theenterprise network, the target being selected based on a disruptionoccurring in response to an attack on the target; the disruption isbased on one or more metrics; and the one or more metrics comprise lossof technical resources, physical losses, disruption in services, andfinancial losses.

The present disclosure also provides a computer-readable storage mediumcoupled to one or more processors and having instructions stored thereonwhich, when executed by the one or more processors, cause the one ormore processors to perform operations in accordance with implementationsof the methods provided herein.

The present disclosure further provides a system for implementing themethods provided herein. The system includes one or more processors, anda computer-readable storage medium coupled to the one or more processorshaving instructions stored thereon which, when executed by the one ormore processors, cause the one or more processors to perform operationsin accordance with implementations of the methods provided herein.

It is appreciated that methods in accordance with the present disclosurecan include any combination of the aspects and features describedherein. That is, methods in accordance with the present disclosure arenot limited to the combinations of aspects and features specificallydescribed herein, but also include any combination of the aspects andfeatures provided.

The details of one or more implementations of the present disclosure areset forth in the accompanying drawings and the description below. Otherfeatures and advantages of the present disclosure will be apparent fromthe description and drawings, and from the claims.

DESCRIPTION OF DRAWINGS

FIG. 1 depicts an example architecture that can be used to executeimplementations of the present disclosure.

FIG. 2 depicts an example conceptual architecture of an agile securityplatform of the present disclosure.

FIG. 3 depicts an example attack graph in accordance withimplementations of the present disclosure.

FIG. 4 depicts an example conceptual architecture in accordance withimplementations of the present disclosure.

FIG. 5 depicts an example process that can be executed in accordancewith implementations of the present disclosure.

Like reference symbols in the various drawings indicate like elements.

DETAILED DESCRIPTION

Implementations of the present disclosure are directed to an agilesecurity platform for enterprise-wide cyber-security. More particularly,implementations of the present disclosure are directed to an agilesecurity platform that determines asset vulnerability of enterprise-wideassets including cyber-intelligence and discovery aspect of enterpriseinformation technology (IT) systems, and enterprise operationaltechnology (OT) systems, asset value, and potential for asset breachincluding hacking analytics of enterprise IT/OT systems performed in anon-intrusive manner. In general, and as described in further detailherein, the agile security platform of the present disclosureprioritizes risks and respective remediations based on vulnerabilitiesof assets within an enterprise network (e.g., cyber intelligence anddiscovery aspect of IT/OT systems), the value of the assets, and theprobability that the assets will be breached.

More particularly, and as described in further detail herein,implementations of the present disclosure are directed to leveraging oneor more attack graphs (AGs) generated by the agile security platform toprioritize alerts. In some implementations, data provided from the oneor more AGs is correlated with security information and event management(STEM) data and/or security operations center (SOC) data to identifyprobable and/or high-risk attack paths, and prioritize alerts associatedwith such attack paths. For example, one or more AGs can be leveraged todecrease a number of irrelevant alerts and increase visibility ofrelatively critical alerts. In this manner, implementations of thepresent disclosure optimize time utilization, improve response times,and increase quality level in attending to real incidents.

In some implementations, the agile security platform of the presentdisclosure enables continuous cyber and enterprise-operations alignmentcontrolled by risk management. The agile security platform of thepresent disclosure improves decision-making by helping enterprises toprioritize security actions that are most critical to their operations.In some implementations, the agile security platform combinesmethodologies from agile software development lifecycle, IT management,development operations (DevOps), and analytics that use artificialintelligence (AI). In some implementations, agile security automationbots continuously analyze attack probability, predict impact, andrecommend prioritized actions for cyber risk reduction. In this manner,the agile security platform of the present disclosure enablesenterprises to increase operational efficiency and availability,maximize existing cyber-security resources, reduce additionalcyber-security costs, and grow organizational cyber resilience.

As described in further detail herein, the agile security platform ofthe present disclosure provides for discovery of IT/OT supportingelements within an enterprise, which elements can be referred to asconfiguration items (CI). Further, the agile security platform candetermine how these CIs are connected to provide a CI network topology.In some examples, the CIs are mapped to process and services of theenterprise, to determine which CIs support which services, and at whatstage of an operations process. In this manner, a services CI topologyis provided.

In some implementations, the specific vulnerabilities of each CI aredetermined, and enable a list of risks to be mapped to the specificIT/OT network of the enterprise. Further, the agile security platform ofthe present disclosure can determine what a malicious user (hacker)could do within the enterprise network, and whether the malicious usercan leverage additional elements in the network such as scripts, CIconfigurations, and the like. Accordingly, the agile security platformenables analysis of the ability of a malicious user to move inside thenetwork, namely, lateral movement within the network. This includes, forexample, how a malicious user could move from one CI to another CI, whatCI (logical or physical) can be damaged, and, consequently, damage to arespective service provided by the enterprise.

FIG. 1 depicts an example architecture 100 in accordance withimplementations of the present disclosure. In the depicted example, theexample architecture 100 includes a client device 102, a network 106,and a server system 108. The server system 108 includes one or moreserver devices and databases (e.g., processors, memory). In the depictedexample, a user 112 interacts with the client device 102.

In some examples, the client device 102 can communicate with the serversystem 108 over the network 106. In some examples, the client device 102includes any appropriate type of computing device such as a desktopcomputer, a laptop computer, a handheld computer, a tablet computer, apersonal digital assistant (PDA), a cellular telephone, a networkappliance, a camera, a smart phone, an enhanced general packet radioservice (EGPRS) mobile phone, a media player, a navigation device, anemail device, a game console, or an appropriate combination of any twoor more of these devices or other data processing devices. In someimplementations, the network 106 can include a large computer network,such as a local area network (LAN), a wide area network (WAN), theInternet, a cellular network, a telephone network (e.g., PSTN) or anappropriate combination thereof connecting any number of communicationdevices, mobile computing devices, fixed computing devices and serversystems.

In some implementations, the server system 108 includes at least oneserver and at least one data store. In the example of FIG. 1, the serversystem 108 is intended to represent various forms of servers including,but not limited to a web server, an application server, a proxy server,a network server, and/or a server pool. In general, server systemsaccept requests for application services and provides such services toany number of client devices (e.g., the client device 102 over thenetwork 106). In accordance with implementations of the presentdisclosure, and as noted above, the server system 108 can host an agilesecurity platform.

In the example of FIG. 1, an enterprise network 120 is depicted. Theenterprise network 120 represents a network implemented by an enterpriseto perform its operations. In some examples, the enterprise network 120represents on-premise systems (e.g., local and/or distributed),cloud-based systems, and/or combinations thereof. In some examples, theenterprise network 120 includes IT systems and OT systems. In general,IT systems include hardware (e.g., computing devices, servers,computers, mobile devices) and software used to store, retrieve,transmit, and/or manipulate data within the enterprise network 120. Ingeneral, OT systems include hardware and software used to monitor anddetect or cause changes in processes within the enterprise network 120.

In some implementations, the agile security platform of the presentdisclosure is hosted within the server system 108, and monitors and actson the enterprise network 120, as described herein. More particularly,and as described in further detail herein, the agile security platformdetects IT/OT assets and generates an asset inventory and network maps,as well as processing network information to discover vulnerabilities inthe enterprise network 120, and provide a holistic view of network andtraffic patterns. In some examples, the enterprise network 120 includesmultiple assets. Example assets include, without limitation, users 122,computing devices 124, electronic documents 126, and servers 128.

In some implementations, the agile security platform provides one ormore dashboards, alerts, notifications and the like to cyber-securitypersonnel that enable the cyber-security personnel to react to andremediate security relevant events. For example, the user 112 caninclude a cyber-security expert that views and responds to dashboards,alerts, and/or notifications of the agile security platform using theclient device 102.

In accordance with implementations of the present disclosure, the agilesecurity platform operates over multiple phases. Example phases includean asset discovery, anomaly detection, and vulnerability analysis phase,a cyber resilience risk analysis phase, and a cyber resilience riskrecommendation phase.

With regard to the asset discovery, anomaly detection, and vulnerabilityanalysis phase, discovering what vulnerabilities exit across thevertical stack and the relevant use cases is imperative to be conductedfrom the enterprise IT to the control systems. A focus of this phase isto generate the security backlog of issues, and potential remediations.

Rather than managing each technology layer separately, the agilesecurity platform of the present disclosure addresses lateral movementsacross the stack. Through devices, communication channels (e.g., email),and/or operation systems, vulnerabilities are addressed within thecontext of a service, and a cyber kill chain to a target in theoperation vertical, generating operation disturbance by manipulation ofdata. The notion of a CI assists in mapping dependencies between ITelements within a configuration management DB (CMIDB). A so-calledsecurity CI (SCI) maps historical security issues of a certain managedsecurity element and mapped into a security aspect of a digital twin.

As a result, a stack of technologies is defined, and is configured in aplug-in reference architecture (replaceable and extendible) manner. Thestack addresses different aspects of monitoring, harvesting, andalerting of information within different aggregations views (dashboards)segmented according to owners and relevant IT and security users. Anexample view includes a health metric inserted within the dashboard ofan enterprise application. In some examples, the health metric indicatesthe security condition of the underlying service and hence, thereliability of the provided data and information. Similar to risks thatcan be driven by labor, inventory, or energy, security risk concern canbe presented and evaluated in the operations-level, drilled-through foradditional transparency of the issue, and can be optimally remediated byallocating investments to automation or to security and IT personal withadequate operations awareness.

With regard to the cyber resilience risk analysis phase, eachvulnerability may have several remediations, and each has a costassociated with it, either per internal personnel time, transaction,service, or retainer, as well as the deferred cost of not acting on theissue. A focus of this phase is to enable economical decision-making ofsecurity investments, either to be conducted by the IT and security teamor directly by automation, and according to risk mitigation budget.

In further detail, observing a single-issue type and its remediationsdoes not reflect the prioritization between multiple vulnerabilities.Traditional systems are based on global risk assessment, yet the contextin which the SCI is part of is missing. The overall risk of a processmatters differently for each enterprise. As such, remediation wouldoccur according to gradual hardening of a process according toprioritization, driven in importance and responsibility by theenterprise, not by gradual hardening of all devices, for example, in theorganization according to policy, without understanding of the impact onseparated operational processes. Hardening of a system should be adecision of the enterprise to drive security alignment with theenterprise.

In addition, as the system is changed by gradual enforcement andhardening, new issues are detected and monitored. Hence, making a bigbang decision may be not relevant to rising risks as they evolve.Prioritization according to value is the essence of this phase. It is amatter of what is important for the next immediate term, according tooverall goals, yet considering changes to the environment.

With regard to the cyber resilience risk recommendation phase, a focusis to simplify approved changes and actions by proactive automation. Intraditional systems, the action of IT remediation of security issues iseither done by the security team (such as awareness and training), bycreating a ticket in the IT service system (call for patch managements),and/or by tools that are triggered by security and monitored by IT(automatic deployment of security policies, change of authentication andauthorization, self-service access control management, etc.). Someoperations can be conducted in disconnected mode, such as upgradingfirmware on an IoT device, in which the operator needs to access thedevice directly. Either automated or manual, by IT or by security, or byinternal or external teams, the entire changes are constantly assessedby the first phase of discovery phase, and re-projected as a metric in acontext. Progress tracking of these changes should also occur in agradual manner, indicating maintenance scheduling on similar operationalprocesses, hence, driving recommendations for frequent actions that canbe automated, and serve as candidates to self-managed by the operationsowners and systems users.

In the agile security platform of the present disclosure, acting is morethan automating complex event processing (CEP) rules on alerts capturedin the system logs and similar tools. Acting is started in areashighlighted according to known patterns and changing risks. Patterndetection and classification of events for approved automation processes(allocated transactions budget), are aimed at commoditization ofsecurity hardening actions in order to reduce the attention needed forprioritization. As such, a compound backlog and decision phase, canfocus further on things that cannot be automated versus those that can.All issues not attended yet are highlighted, those that are handled byautomation are indicated as such, and monitored to completion, with apotential additional value of increasing prioritization due to changingrisks impact analysis.

FIG. 2 depicts an example conceptual architecture 200 of an agilesecurity (AgiSec) platform in accordance with implementations of thepresent disclosure. The conceptual architecture 200 depicts a set ofsecurity services of the AgiSec platform, which include: an agilesecurity prioritization (AgiPro) service 204, an agile security businessimpact (AgiBuiz) service 206, an agile security remediation (AgiRem)service 210, an agile security hacker lateral movement (AgiHack) service208, an agile security intelligence (AgiInt) service 212, and an agilesecurity discovery (AgiDis) service 214. The conceptual architecture 200also includes an operations knowledge base 202 that stores historicaldata provided for an enterprise network (e.g., the enterprise network120).

In the example of FIG. 2, the AgiDis service 214 includes an adaptor234, and an asset/vulnerabilities knowledge base 236. In some examples,the adaptor 234 is specific to an asset discovery tool (ADT) 216.Although a single ADT 216 is depicted, multiple ADTs can be provided,each ADT being specific to an IT/OT site within the enterprise network.Because each adaptor 234 is specific to an ADT 216, multiple adaptors234 are provided in the case of multiple ADTs 216.

In some implementations, the AgiDis service 214 detects IT/OT assetsthrough the adaptor 234 and respective ADT 216. The discovered assetscan be used to generate an asset inventory, and network maps. Ingeneral, the AgiDis service 214 can be used to discover vulnerabilitiesin the enterprise network, and a holistic view of network and trafficpatterns. In some implementations, this is achieved through passivenetwork scanning and device fingerprinting through the adaptor 234 andADT 216. The AgiDis service 214 provides information about devicemodels.

In the example of FIG. 2, the AgiInt service 212 includes avulnerability analytics module 236 and a threat intelligence knowledgebase 238 (e.g., CVE, CAPEC, CWE, Maglan Plexus, iDefence API,vendor-specific databases). In some examples, the AgiInt service 212discovers vulnerabilities in the enterprise network based on dataprovided from the AgiDis service 214. In some examples, thevulnerability analytics module 236 processes data provided from theAgiDis service 214 to provide information regarding possible impacts ofeach vulnerability and remediation options (e.g., permanent fix,temporary patch, workaround) for defensive actions. In some examples,the vulnerability analytics module 236 can include an applicationprogramming interface (API) that pulls out discovered vulnerabilitiesand identifies recommended remediations using threat intelligence feeds.In short, the AgiInt service 212 maps vulnerabilities and threats todiscovered IT/OT assets.

In the example of FIG. 2, the AgiHack service 208 includes an attachgraph (AG) generator 226, an AG database 228, and an analytics module230. In general, the AgiHack service 208 constructs AGs and evaluateshacking exploitation complexity. In some examples, the AgiHack service208 understand attack options, leveraging the vulnerabilities todetermine how a hacker would move inside the network and identifytargets for potential exploitation. The AgiHack service 208 proactivelyexplores adversarial options and creates AGs representing possibleattack paths from the adversary's perspective. The AgiHack service 208provides both active and passive vulnerability scanning capabilities tocomply with constraints, and identifies device and servicevulnerabilities, configuration problems, and aggregate risks throughautomatic assessment.

In further detail, the AgiHack service 208 provides rule-basedprocessing of data provided from the AgiDis service 214 to explore allattack paths an adversary can take from any asset to move laterallytowards any target (e.g., running critical operations). In someexamples, multiple AGs are provided, each AG corresponding to arespective target within the enterprise network. Further, the AgiHackservice 208 identifies possible impacts on the targets. In someexamples, the AG generator 226 uses data from the asset/vulnerabilitiesknowledge base 236 of the AgiDis service 214, and generates an AG. Insome examples, the AG graphically depicts, for a respective target, allpossible impacts that may be caused by a vulnerability or network/systemconfiguration, as well as all attack paths from anywhere in the networkto the respective target. In some examples, the analytics module 230processes an AG to identify and extract information regarding criticalnodes, paths for every source-destination pair (e.g., shortest, hardest,stealthiest), most critical paths, and critical vulnerabilities, amongother features of the AG. If remediations are applied within theenterprise network, the AgiHack service 208 updates the AG.

In the example of FIG. 2, the AgiRem service 210 includes a graphexplorer 232 and a summarizer 234. In general, the AgiRem service 210provides remediation options to avoid predicted impacts. For example,the AgiRem service 210 provides options to reduce lateral movement ofhackers within the network and to reduce the attack surface. The AgiRemservice 210 predicts the impact of asset vulnerabilities on the criticalprocesses and adversary capabilities along kill chain/attack paths andidentifies the likelihood of attack paths to access critical assets andprioritizes the assets (e.g., based on shortest, easiest, stealthiest).The AgiRem service 210 identifies remediation actions by exploringattack graph and paths.

In further detail, for a given AG (e.g., representing allvulnerabilities, network/system configurations, and possible impacts ona respective target) generated by the AgiHack service 208, the AgiRemservice 210 provides a list of efficient and effective remediationrecommendations using data from the vulnerability analytics module 236of the AgiInt service 212. In some examples, the graph explorer 232analyzes each feature (e.g., nodes, edges between nodes, properties) toidentify any condition (e.g., network/system configuration andvulnerabilities) that can lead to cyber impacts. Such conditions can bereferred to as issues. For each issue, the AgiRem service 210 retrievesremediation recommendations and courses of action (CoA) from the AgiIntservice 212, and/or a security knowledge base (not shown). In someexamples, the graph explorer 232 provides feedback to the analyticsmodule 230 for re-calculating critical nodes/assets/paths based onremediation options. In some examples, the summarizer engine 234 isprovided as a natural language processing (NLP) tool that extractsconcise and salient text from large/unstructured threat intelligencefeeds. In this manner, the AgiSec platform can convey information toenable users (e.g., security teams) to understand immediate remediationactions corresponding to each issue.

In the example of FIG. 2, the AgiBuiz service 204 includes an impactanalyzer 220. In general, the AgiBuiz service 204 associates servicesthat are provided by the enterprise with IT/OT assets, generates asecurity map, identifies and highlights risks and possible impacts onenterprise operations and industrial processes, and conducts what-ifprediction analyses of potential security actions remediations onservice health levels. In other words, the AgiBuiz service 204identifies risk for each impact predicted by the AgiHack service 208. Insome examples, the impact analyzer 220 interprets cyber risks andpossible impacts (e.g., financial risk) based on the relative importanceof each critical asset and its relative value within the entirety of theenterprise operations. The impact analyzer 220 processes one or moremodels to compare the financial risks caused by cyber attacks with thosecaused by system unavailability due to shutdown time forreplacing/patching critical assets.

In the example of FIG. 2, the AgiPro service 206 includes a prioritizingengine 222 and a scheduler 224. In some implementations, the AgiProservice 206 prioritizes the remediation recommendations based on theirimpact on the AG size reduction and risk reduction on the value. In someexamples, the AgiPro service 206 determines where the enterprise shouldpreform security enforcement first, in order to overall reduce the risksdiscovered above, and evaluate impact and probability to perform harmbased on the above lateral movements by moving from one CI to another.In some examples, the AgiPro service 206 prioritizes remediation actionsbased on financial risks or other implications, provides risk reductionrecommendations based on prioritized remediations, and identifies andtracks applied remediations for risks based on recommendations.

In some examples, the prioritizing engine 222 uses the calculated risks(e.g., risks to regular functionality and unavailability of operationalprocesses) and the path analysis information from the analytics module230 to prioritize remediation actions that reduce the risk, whileminimizing efforts and financial costs. In some examples, the scheduler224 incorporates the prioritized CoAs with operational maintenanceschedules to find the optimal time for applying each CoA that minimizesits interference with regular operational tasks.

In some implementations, the AgiSec platform of the present disclosureprovides tools that enable user interaction with multi-dimensional(e.g., 2D, 3D) visualizations of computational graph data and itsderived computed attributes. In some examples, topological heat maps canbe provided and represent ranks and values of the derived attributes inorder to expediate search capabilities over big data. In some examples,the tools also enable searching for key attributes of critical nodes,nodes representing CIs. In some implementations, these visualizationsare provided within a computer or immersive environment, such asaugmented reality (AR), mixed reality (MR), or virtual reality (VR). Thevisualizations of the present disclosure improve the ability of anautomated (employing contour lines) or human interactive (based onsegmented regional selection) to employ search and filteringcapabilities on big data graph topology aimed at quickly identifyingquickly critical nodes in the graph which its derived (computed)attributes serve as the search criteria. The attributes to behighlighted differ and are configurable, as such, different contourlines appear based on different criteria. In some examples, theperceived importance of an attribute relative to other attributes can becontrolled in view of a scenario, vertical importance, or anydomain-specific consideration, through weighed attributes. Further,similar contour lines can be identified in other nearby nodes on thegraph. For an immersive visualization experience, matching leadingcontour lines can show hidden paths, or pattern of similar geometricshape and form, hence drive improved comprehension for humans.

In the context of cyber security, a critical node, also referred toherein as cardinal node, can represent a CI that is a key junction forlateral movements within a segmented network. Namely, once acquired as atarget, the cardinal node can trigger multiple new attack vectors.Cardinal nodes can also be referred to as “cardinal faucet nodes.”Another node will be one that many hackers' lateral movements can reach,yet it cannot lead to an additional node. Such nodes can be referred toas “cardinal sink nodes.” In the network graph, the more edges from acardinal faucet node to other nodes, the higher the faucet attribute is.The more incoming edges to a cardinal node, the higher the sinkattribute is. If a node has both sink and faucet values in correlation,the more overall cardinal this node becomes to the entire examined graphtopology and is defined as a critical target to be acquired since itprovides control over multiple nodes in the graphs. In certainsituations, the search for a faucet attribute is more important than asink attribute. Such as a case of finding what node to block first toprevent a segregation of an attack outbreak. In case of finding what isvery hard to protect, the more sink attributes matter more.

FIG. 3 depicts an example portion 300 of an AG in accordance withimplementations of the present disclosure. In some implementations, andAG is provided based on the network topology of the enterprise network.For example, the AgiHack service 208 of FIG. 2 can generate one or moreAGs based on information provided from the AgiDis service 214. In someexamples, an AG includes nodes and edges (also referred to as arches)between nodes. In some examples, a node can be associated with asemantic type. In the example domain of cyber-security and networktopology, example semantic types can include, without limitation,computer 302, user 304, file 306, and key 308.

In some examples, an edge can include an incoming (sink) edge (e.g., anedge leading into a node from another node) or an outgoing (faucet) edge(e.g., an edge leading from a node to another node). In some examples,each edge can be associated with a respective activity. In the exampledomain of cyber-security and network topology, example activities caninclude, without limitation, logon (credentials), operating systemaccess, and memory access. In some examples, each edge can be associatedwith a respective weight. In some examples, the weight of an edge can bedetermined based on one or more features of the edge. Example featurescan include a traffic bandwidth of the edge (e.g., how much networktraffic can travel along the edge), a speed of the edge (e.g., howquickly traffic can travel from one node to another node along theedge), a difficulty to use the edge (e.g., network configurationrequired to use the edge), and a cost to use the edge (e.g., in terms oftechnical resources, or financial cost). In some examples, and asdescribed in further detail below, the weights of the edges aredetermined relative to each other (e.g., are normalized to 1).

In some implementations, each node can be associated with a set ofattributes. Example attributes can include, without limitation, thesemantic type of the node, a number of incoming edges, a number ofoutgoing edges, a type of each of the edges, a weight of each of theedges, and the like. In some implementations, one or more values for anode can be determined based on the set of attributes of the node, asdescribed in further detail herein.

The example portion 300 of the AG includes tens of nodes (approximately70 nodes in the example of FIG. 3). It is contemplated, however, that anAG can include hundreds, or thousands of nodes. In some examples, theexample portion 300 of the AG is a visualization of part of the AG basedon one or more filter parameters. In some examples, a user can definefilter parameters that can be used to identify cardinal nodes within anAG, and segments of the AG that may be relevant to a cardinal node. Inthe example of FIG. 3, a node 320 can be determined to be a cardinalnode based on one or more filter parameters (e.g., no outgoing edges,and more than three incoming edges). In some examples, other depictednodes include nodes along lateral paths that lead to a cardinal node.

In the example of FIG. 3, the node 320 can represent administratorcredentials, a relatively high-value target within an enterprisenetwork, and all other edges and nodes define the paths within the AGthat lead to the node 320. While the AG can include hundreds, orthousands of nodes and edges, the example portion 300 is provided basedon identification of the node 320 as the cardinal node (e.g., based onfilter parameters) and all paths of the AG that lead to the node 320. Inthis manner, the portion 320 provides a more easily consumablevisualization than depicting an entirety of the AG.

In some implementations, other nodes besides the cardinal node can beidentified as relatively important nodes (e.g., relative to otherdepicted nodes). In some examples, the relative importance of a node canbe determined based on attack paths that lead to a cardinal node. In theexample of FIG. 3, a node 322 can be determined to be a relativelyimportant node. Starting from the node 322, there is a single attackpath to the node 320. However, there are approximately ten differentattack paths that the node 322 is included in. Consequently, securityresources could be concentrated on the node 322, as opposed to nodesupstream of the node 322 in the multiple attack paths. In this manner,security resources can more efficiently protect the node 320, asdescribed in further detail herein.

Further, AGs can change over time. That is, there is a multi-dimensionalaspect to AGs with one dimension including time. For example, and withcontinued reference to the example of FIG. 3, the node 320 can beconsidered a cardinal node based on the filter parameters. At anothertime, the node 320 might no longer be considered a cardinal node. Forexample, between the first time and the second time, values ofattributes may have changed for nodes, some nodes may have been removedfrom the network (e.g., computers retired, users removed), and/or somenodes may have been added to the network (e.g., new computers/users).

As introduced above, and in accordance with implementations of thepresent disclosure, a node of the AG can be identified as a cardinalnode. In some examples, a cardinal node is a node that is deemed to be akey junction, and therefore, a target of attack within a network. Asdescribed in further detail herein, implementations of the presentdisclosure enable searching for cardinal nodes over a graph databasebased on attributes and weights.

In some implementations, an incoming value (IV) of each node of an AG iscalculated. In some examples, the IV of a respective node k (IV_(k)) iscalculated based on node attributes (e.g., a number of incoming edges,semantic types of the edges). The following example relationship isprovided:

IV _(k)=Σ_(j=1) ^(m)(WArchSType_(j)×Σ_(i=1) ^(n)ValArchSType_(ij))  (1)

where

Σ_(i=1) ^(n)ValArchSType_(ij)≥0  (2)

where n is the number of edges (arches) per semantic type S(j) that areeither outgoing for the case of a faucet node, or incoming for the caseof a sink node, m is the total number of semantic types S per the nodek, and 1<=j<=m, and 1<=k<=K, where K is the total number of nodes beingconsidered (e.g., in a segmented section of the graph). The exampleEquation 1 above applies to outgoing or incoming edges respectively.

Another example relationship can be provided as:

1=Σ_(j=1) ^(v)(WArchSType_(j))  (3)

Namely all weights are normalized to unity and any change to one weightvalue affects the normalization of other weights. In some example, v isall of the weights of all of the semantic types of arches in outgoing orincoming arches respectively.

In some implementations, an outgoing value (OV) of each node of the AGis calculated, as described above for IV (e.g., IV is calculated for theincoming edges, and OV is calculated for the outgoing edges). That is,the OV of a respective node k (OV_(k)) is calculated based on nodeattributes, a number of outgoing edges, and semantic types of the edges.In some implementations, an overall value of a respective node isdetermined based on the node's IV and OV values (e.g., as a sum, aweighted sum, an average, a weighted average).

As introduced above, implementations of the present disclosure aredirected to leveraging one or more AGs generated by the AgiSec platformto optimize alerts generated by the AgiSec platform. In someimplementations, data provided from the one or more AGs is correlatedwith STEM data and/or security operations center SOC data to identifyprobable and/or high-risk attack paths, and prioritize alerts associatedwith such attack paths.

In some implementations, a SIEM platform is provided and combinessecurity information management (SIM) and security event management(SEM). In some examples, the STEM platform provides real-time analysisof security alerts generated by applications and/or network hardware.Example SIEM platforms include, without limitation, Splunk EnterpriseSecurity (ES) provided by Splunk Inc. of San Francisco, Calif., IBMQRadar STEM provided by International Business Machines Corporation ofArmonk, N.Y., and ArcSight STEM provided by eSec Forte Technologies Pvt.Ltd. of New Dehli, India. It is contemplated that implementations of thepresent disclosure can be realized with any appropriate SIEM platform.

In general, the SIEM platform provides a suite of functionality (e.g.,computer-executable programs) for managing, analyzing and correlatingmultiple sources of security information and log files in a network.Example functionality can include, without limitation, data aggregation,correlation, alerting, and dashboards. For example, the SIEM platformcan include data aggregation, in which log management aggregates datafrom multiple sources within the network to provide monitored data thatis consolidated and analyzed to help avoid missing critical eventsoccurring within the network. Example sources can include network,security, servers, databases, and applications. As another example, theSTEM platform can include correlation that processes data to find commonattributes, and links events together into meaningful bundles. In someexamples, correlation enables the performance of a variety ofcorrelation techniques to integrate different sources. As anotherexample, the STEM platform provides alerting, which can includeautomated analysis of correlated events, and generating alerts torelevant personnel. As still another example, the STEM platform canprovide one or more dashboards that present event data and alerts tousers.

In some implementations, the SIEM platform detects occurrence of and isresponsive to events occurring within the network. Example events caninclude, without limitation, log-in attacks (e.g., brute-force attacks,password guessing, misconfigured applications), firewall attacks (e.g.,firewall drop/reject/deny events), network intrusion attempts, hostintrusion attempts, and malware detection (e.g., virus, spyware). Insome examples, an alert can be generated in response to occurrence of anevent. In some implementations, the SIEM platform can associate one ormore assets within the network with one or more alerts.

In some examples, the STEM platform can indicate a criticality of analert (e.g., an event that underlies the alert). In some examples, acriticality of an alert can be based on confidentiality, integrity andavailability (CIA) scoring. In general, confidentiality can be describedas a set of rules that limits access to information, integrity can bedescribed as an assurance that the information is trustworthy andaccurate, and availability can be described as a guarantee of reliableaccess to the information. For a given asset underlying an alert, eachof these CIA elements can have a score associated therewith. In thismanner, a score indicating a relative importance of the asset can beprovided, and the scores can be used to prioritize alerts. However, suchtechniques for prioritizing alerts can be based on static informationthat may be manually input be users. Further, while such techniques canprioritize alerts, they do not reduce the number of alerts that might bepresented.

In accordance with implementations of the present disclosure, AG datacan be provide from the AgiSec platform to a SIEM platform, and can beused to filter SIEM data and/or prioritize alerts provided from the SIEMplatform. For example, and as described above, an AG can be provided foreach of a plurality of high-value targets (e.g., crown jewels) within anetwork. Referring again to the example of FIG. 3, the node 320 canrepresent administrator credentials, a relatively high-value targetwithin an enterprise network, and all other edges and nodes define thepaths within the AG that lead to the node 320. In some examples, a valueof a target can be determined based on disruption to the enterprise,which can be provided on one or more metrics. Example metrics caninclude, without limitation, loss of technical resources (e.g.,computing devices, database systems, software systems), physical losses(e.g., assets being physically destroyed), and financial losses (e.g.,disruptions to enterprise that result in financial loss). An enterprisenetwork can have multiple high-value targets, and an AG can be providedfor each. In some examples, within each AG, one or more critical pathscan be identified, a critical path being a path within the AG to thehigh-value target. In some examples, a path is determined to becritical, if traversal along the path could ultimately lead to thehigh-value target. If, for example, a path leads to a node that isisolated from the high-value target, the path is not deemed to becritical.

At a high-level, implementations of the present disclosure addressproblems in SIEM platforms, such as reducing the number of falsepositives in alerts. As described in further detail herein,implementations of the present disclosure enable use of AG informationto automate prioritization of alerts, and filter data that alerts aretriggered on. Accordingly, implementations of the present disclosurecorrelate data between different domains, the SIEM domain, and theAgiSec domain. For example, some assets along a lateral movement pathwithin an AG may be more critical than others. An asset that is closerto target may be considered more critical than an asset that is furtherfrom the target. In some examples, AG data provided to the STEM platformcan include asset information (e.g., IP address, host name, version,operating system, server type) and whether the asset is one a criticalpath.

In some implementations, AG data can be used in multiple scenarioswithin the STEM platform, each scenario addressing a philosophy foraddressing security issues within enterprise networks. In a firstscenario, also referred to as an upstream scenario, security issues canbe proactively addressed prior to occurrence of any events. In a secondscenario, also referred to as a downstream scenario, events areaddressed in response to occurrences.

With regard to the first scenario, a defensive posture can beconsidered, in which one or more simulations are provided for virtualadversaries and potential attack paths to targets. In this manner, a setof potential attacks can be defined. For each potential attack, data canbe provided that indicates assets that would be involved in thepotential attack. In some examples, AG data can be provided to and canbe compared to the data provided in the set of potential attacks. Insome examples, the AG data can indicate relative closeness of assets interms of propagation of an attack toward a high-value target. In someexamples, the AG data can indicate any assets (e.g., computers, devices,systems) in a potential attack that are also included in a critical pathof an AG. If an asset is included in a potential attack and is along acritical path, this can be indicated as such within the data (e.g., acritical path flag can be set for the asset). In some examples, if anattack occurs, the AG data can be used by the STEM to filter data thatis used to generate alerts. For example, assets that are outside of athreshold distance from a high-value target within an AG can be filteredout, such that an event/alert is not triggered, or, if an event/alert istriggered, a priority of the alert can be provided based on the AG data.As another example, if an asset that is the subject of an alert isflagged as being in a critical path, a priority of the alert can beelevated.

With regard to the second scenario, the STEM platform can process (e.g.,perform analytics over) data received from multiple data sources (e.g.,firewall logs, anti-virus logs, network access logs), and can generateevents. In some examples, for an event, a priority of the alert can beprovided based on a traditional technique, such as CIA, described above.Accordingly, an event can be suspected as being critical based on theinitially assigned priority (e.g., CIA score). In accordance withimplementations of the present disclosure, the AG data can be usedselectively enhance the criticality of the event and elevate thecorresponding alert. In some examples, the SIEM platform can identifyone or more assets that underly an alert. For example, if an alert isbased on a log-in attack associated with a particular computing devicewithin the network at least one AG that include the computing device canbe referenced. It can be determined whether the asset is on a criticalpath within an AG. If the asset is on a critical path, a priority of thealert is increased.

FIG. 4 depicts an example conceptual architecture 400 for leveraging AGsin accordance with implementations of the present disclosure. Theexample conceptual architecture 400 includes a prioritization platform402 and a SOC interface 404 for displaying alerts. As described infurther detail herein, the prioritization platform 402 receives datafrom one or more data sources 406, 408, 410, 412. Example data sourcescan include, without limitation, a firewall log data 406, anti-virus logdata 408, user authentication logs 410, and operating system logs 412.

In the depicted example, the prioritization platform 402 includes a SIEMplatform 420 and AG data 422. In some examples, the SIEM platform 420processes data provided from one or more of the data sources 406, 408,410, 412 to selectively generate events and alerts. For example, theSIEM platform 420 can process the data provided from one or more of thedata sources 406, 408, 410, 412 through one or more analytic programs,which can selectively generate an event and alert. For example, an eventand alert can be generated, if the data indicates that a thresholdnumber of failed login attempts within a threshold time period at aparticular host (e.g., computing device). As another example, an eventand alert can be generated, if the data indicates that a particular hosthas flagged known malware.

In some examples, the AG data 422 represents multiple AGs, each AG beingassociated with a high-value target as identified within the AgiSecplatform of the present disclosure. In some implementations, the AG data422 can be used in multiple scenarios, such as the first scenario andthe second scenario described herein. For example, in the firstscenario, the AG data 422 can be used to filter the amount of data thatis processed for generating events and alerts, such that events andalerts that are generated and visualized in the SOC interface 404 have ahigher likelihood of representing an actual attack that is ofsignificance. In this manner, a reduced number of alerts are generated,the alerts being of higher quality (e.g., reduced false positives). Asanother example, in the second scenario, an asset that underlies anevent can be cross-referenced with the AG data 422 to determine whetherthe asset is included along a critical path of an AG. If the asset isalong a critical path, the priority of the alert is enhanced (e.g.,bumped from important to critical).

FIG. 5 depicts an example process 500 that can be executed in accordancewith implementations of the present disclosure. In some implementations,the example process 500 may be performed using one or morecomputer-executable programs executed using one or more computingdevices. The example process 500 can be performed for security ofenterprise networks.

AG data is received (502). In some examples, the AG data is receivedfrom an agile security platform. The AG data is representative of one ormore AGs, each AG representing one or more lateral paths within anenterprise network for reaching a target asset from one or more assetswithin the enterprise network. In some implementations, each AG isgenerated by a discovery service of the agile security platform, thediscovery service detecting assets using one or more adaptors andrespective asset discovery tools that generate an asset inventory and anetwork map of the enterprise network. In some implementations, each AGis associated with a target within the enterprise network, the targetbeing selected based on a disruption occurring in response to an attackon the target. In some examples, the disruption is based on one or moremetrics. In some examples, the one or more metrics include loss oftechnical resources, physical losses, disruption in services, andfinancial losses.

Data is processed (504). For example, a security platform processes datafrom one or more data sources to selectively generate at least oneevent. In some examples, the at least one event represents a potentialsecurity risk within the enterprise network. An alert is selectivelygenerated (506). For example, an alert is generated within the securityplatform. The alert represents the at least one event. In accordancewith implementations of the present disclosure, the alert is associatedwith a priority within a set of alerts, the priority being is based onthe AG data. In some implementations, the alert is associated with anasset and is assigned an initial priority, and the priority includes anelevated priority relative to the initial priority based on the AG data.In some implementations, the initial priority is elevated to thepriority in response to determining that the asset is included in acritical path represented within the AG data. In some implementations,the event is selectively generated based on filtering a plurality ofpotential events based on the AG data.

Implementations and all of the functional operations described in thisspecification may be realized in digital electronic circuitry, or incomputer software, firmware, or hardware, including the structuresdisclosed in this specification and their structural equivalents, or incombinations of one or more of them. Implementations may be realized asone or more computer program products, i.e., one or more modules ofcomputer program instructions encoded on a computer readable medium forexecution by, or to control the operation of, data processing apparatus.The computer readable medium may be a machine-readable storage device, amachine-readable storage substrate, a memory device, a composition ofmatter effecting a machine-readable propagated signal, or a combinationof one or more of them. The term “computing system” encompasses allapparatus, devices, and machines for processing data, including by wayof example a programmable processor, a computer, or multiple processorsor computers. The apparatus may include, in addition to hardware, codethat creates an execution environment for the computer program inquestion (e.g., code) that constitutes processor firmware, a protocolstack, a database management system, an operating system, or acombination of one or more of them. A propagated signal is anartificially generated signal (e.g., a machine-generated electrical,optical, or electromagnetic signal) that is generated to encodeinformation for transmission to suitable receiver apparatus.

A computer program (also known as a program, software, softwareapplication, script, or code) may be written in any appropriate form ofprogramming language, including compiled or interpreted languages, andit may be deployed in any appropriate form, including as a stand aloneprogram or as a module, component, subroutine, or other unit suitablefor use in a computing environment. A computer program does notnecessarily correspond to a file in a file system. A program may bestored in a portion of a file that holds other programs or data (e.g.,one or more scripts stored in a markup language document), in a singlefile dedicated to the program in question, or in multiple coordinatedfiles (e.g., files that store one or more modules, sub programs, orportions of code). A computer program may be deployed to be executed onone computer or on multiple computers that are located at one site ordistributed across multiple sites and interconnected by a communicationnetwork.

The processes and logic flows described in this specification may beperformed by one or more programmable processors executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows may also be performedby, and apparatus may also be implemented as, special purpose logiccircuitry (e.g., an FPGA (field programmable gate array) or an ASIC(application specific integrated circuit)).

Processors suitable for the execution of a computer program include, byway of example, both general and special purpose microprocessors, andany one or more processors of any appropriate kind of digital computer.Generally, a processor will receive instructions and data from a readonly memory or a random access memory or both. Elements of a computercan include a processor for performing instructions and one or morememory devices for storing instructions and data. Generally, a computerwill also include, or be operatively coupled to receive data from ortransfer data to, or both, one or more mass storage devices for storingdata (e.g., magnetic, magneto optical disks, or optical disks). However,a computer need not have such devices. Moreover, a computer may beembedded in another device (e.g., a mobile telephone, a personal digitalassistant (PDA), a mobile audio player, a Global Positioning System(GPS) receiver). Computer readable media suitable for storing computerprogram instructions and data include all forms of non-volatile memory,media and memory devices, including by way of example semiconductormemory devices (e.g., EPROM, EEPROM, and flash memory devices); magneticdisks (e.g., internal hard disks or removable disks); magneto opticaldisks; and CD ROM and DVD-ROM disks. The processor and the memory may besupplemented by, or incorporated in, special purpose logic circuitry.

To provide for interaction with a user, implementations may be realizedon a computer having a display device (e.g., a CRT (cathode ray tube),LCD (liquid crystal display), LED (light-emitting diode) monitor, fordisplaying information to the user and a keyboard and a pointing device(e.g., a mouse or a trackball), by which the user may provide input tothe computer. Other kinds of devices may be used to provide forinteraction with a user as well; for example, feedback provided to theuser may be any appropriate form of sensory feedback (e.g., visualfeedback, auditory feedback, or tactile feedback); and input from theuser may be received in any appropriate form, including acoustic,speech, or tactile input.

Implementations may be realized in a computing system that includes aback end component (e.g., as a data server), or that includes amiddleware component (e.g., an application server), or that includes afront end component (e.g., a client computer having a graphical userinterface or a Web browser through which a user may interact with animplementation), or any appropriate combination of one or more such backend, middleware, or front end components. The components of the systemmay be interconnected by any appropriate form or medium of digital datacommunication (e.g., a communication network). Examples of communicationnetworks include a local area network (“LAN”) and a wide area network(“WAN”) (e.g., the Internet).

The computing system may include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other.

While this specification contains many specifics, these should not beconstrued as limitations on the scope of the disclosure or of what maybe claimed, but rather as descriptions of features specific toparticular implementations. Certain features that are described in thisspecification in the context of separate implementations may also beimplemented in combination in a single implementation. Conversely,various features that are described in the context of a singleimplementation may also be implemented in multiple implementationsseparately or in any suitable sub-combination. Moreover, althoughfeatures may be described above as acting in certain combinations andeven initially claimed as such, one or more features from a claimedcombination may in some cases be excised from the combination, and theclaimed combination may be directed to a sub-combination or variation ofa sub-combination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the implementations described above should not beunderstood as requiring such separation in all implementations, and itshould be understood that the described program components and systemsmay generally be integrated together in a single software product orpackaged into multiple software products.

A number of implementations have been described. Nevertheless, it willbe understood that various modifications may be made without departingfrom the spirit and scope of the disclosure. For example, various formsof the flows shown above may be used, with steps re-ordered, added, orremoved. Accordingly, other implementations are within the scope of thefollowing claims.

What is claimed is:
 1. A computer-implemented method for security ofenterprise networks, the method being executed by one or more processorsand comprising: receiving, from an agile security platform, attack graph(AG) data representative of one or more AGs, each AG representing one ormore lateral paths within an enterprise network for reaching a targetasset from one or more assets within the enterprise network; processing,by a security platform, data from one or more data sources toselectively generate at least one event, the at least one eventrepresenting a potential security risk within the enterprise network;and selectively generating, within the security platform, an alertrepresenting the at least one event, the alert being associated with apriority within a set of alerts, the priority being is based on the AGdata.
 2. The method of claim 1, wherein the alert is associated with anasset and is assigned an initial priority, and the priority comprises anelevated priority relative to the initial priority based on the AG data.3. The method of claim 2, wherein the initial priority is elevated tothe priority in response to determining that the asset is included in acritical path represented within the AG data.
 4. The method of claim 1,wherein the event is selectively generated based on filtering aplurality of potential events based on the AG data.
 5. The method ofclaim 1, wherein each AG is generated by a discovery service of theagile security platform, the discovery service detecting assets usingone or more adaptors and respective asset discovery tools that generatean asset inventory and a network map of the enterprise network.
 6. Themethod of claim 1, wherein each AG is associated with a target withinthe enterprise network, the target being selected based on a disruptionoccurring in response to an attack on the target.
 7. The method of claim6, wherein the disruption is based on one or more metrics.
 8. The methodof claim 7, wherein the one or more metrics comprise loss of technicalresources, physical losses, disruption in services, and financiallosses.
 9. A non-transitory computer-readable storage medium coupled toone or more processors and having instructions stored thereon which,when executed by the one or more processors, cause the one or moreprocessors to perform operations for security of enterprise networks,the operations comprising: receiving, from an agile security platform,attack graph (AG) data representative of one or more AGs, each AGrepresenting one or more lateral paths within an enterprise network forreaching a target asset from one or more assets within the enterprisenetwork; processing, by a security platform, data from one or more datasources to selectively generate at least one event, the at least oneevent representing a potential security risk within the enterprisenetwork; and selectively generating, within the security platform, analert representing the at least one event, the alert being associatedwith a priority within a set of alerts, the priority being is based onthe AG data.
 10. The computer-readable storage medium of claim 9,wherein the alert is associated with an asset and is assigned an initialpriority, and the priority comprises an elevated priority relative tothe initial priority based on the AG data.
 11. The computer-readablestorage medium of claim 10, wherein the initial priority is elevated tothe priority in response to determining that the asset is included in acritical path represented within the AG data.
 12. The computer-readablestorage medium of claim 9, wherein the event is selectively generatedbased on filtering a plurality of potential events based on the AG data.13. The computer-readable storage medium of claim 9, wherein each AG isgenerated by a discovery service of the agile security platform, thediscovery service detecting assets using one or more adaptors andrespective asset discovery tools that generate an asset inventory and anetwork map of the enterprise network.
 14. The computer-readable storagemedium of claim 9, wherein each AG is associated with a target withinthe enterprise network, the target being selected based on a disruptionoccurring in response to an attack on the target.
 15. Thecomputer-readable storage medium of claim 14, wherein the disruption isbased on one or more metrics.
 16. The computer-readable storage mediumof claim 15, wherein the one or more metrics comprise loss of technicalresources, physical losses, disruption in services, and financiallosses.
 17. A system, comprising: one or more computers; and acomputer-readable storage device coupled to the computing device andhaving instructions stored thereon which, when executed by the computingdevice, cause the computing device to perform operations for security ofenterprise networks, the operations comprising: receiving, from an agilesecurity platform, attack graph (AG) data representative of one or moreAGs, each AG representing one or more lateral paths within an enterprisenetwork for reaching a target asset from one or more assets within theenterprise network; processing, by a security platform, data from one ormore data sources to selectively generate at least one event, the atleast one event representing a potential security risk within theenterprise network; and selectively generating, within the securityplatform, an alert representing the at least one event, the alert beingassociated with a priority within a set of alerts, the priority being isbased on the AG data.
 18. The system of claim 17, wherein the alert isassociated with an asset and is assigned an initial priority, and thepriority comprises an elevated priority relative to the initial prioritybased on the AG data.
 19. The system of claim 18, wherein the initialpriority is elevated to the priority in response to determining that theasset is included in a critical path represented within the AG data. 20.The system of claim 17, wherein the event is selectively generated basedon filtering a plurality of potential events based on the AG data. 21.The system of claim 17, wherein each AG is generated by a discoveryservice of the agile security platform, the discovery service detectingassets using one or more adaptors and respective asset discovery toolsthat generate an asset inventory and a network map of the enterprisenetwork.
 22. The system of claim 17, wherein each AG is associated witha target within the enterprise network, the target being selected basedon a disruption occurring in response to an attack on the target. 23.The system of claim 22, wherein the disruption is based on one or moremetrics.
 24. The system of claim 23, wherein the one or more metricscomprise loss of technical resources, physical losses, disruption inservices, and financial losses.